3

We have an NIPS blocking attacks based on bad behaviors (rules checking the data in the network packets). Should I block the IP that the NIPS linked to attack attempts? It feels like the NIPS is already blocking the attack.

At the same time, what is the risk of an IP being reused multiple times with different attacks? (and the possibility that one of these attacks from the same IP isn't known to the NIPS)

I'm mostly talking about incoming traffic from outside.

  • That depends. How important is availability to you? Is there a business interest to let customers who are infected with a botnet trojan to still use your service? How much do you trust your application security to be secure against attacks the NIPS might not catch? How often does your MIPS detect false positives and would you care if you lose their business? How many of your users are behind NAT routers shared with potential attackers? – Philipp Oct 24 '18 at 15:44
  • For the availability, we usually block attempts that comes from outside our country. As for securing the application, I try to do my best. I was talking about the best practice in general. When to block and when to let the NIPS do it's job. – VBTech Oct 24 '18 at 17:09
  • There isn't really a "best practice" as this will depend entirely on your network, assets, risk and threat models etc. – Rory Alsop Oct 28 '18 at 14:30
2

Consideration #1

Performance. With properly sized devices (IPS and firewalls), firewalls are generally more efficient at blocking traffic.

Consideration #2

Ensuring the block is at the network perimeter. You'll want to block traffic as close to the network edge as possible to reduce load, risk, etc.

Consideration #3

It's not just about an attacker reusing an IP, it's about stopping an attack before it succeeds. Commonly, the security best practice is to block IPs that have been identified as performing malicious actions against your organization's infrastructure (e.g., brute force password guessing, persistent port scanning, unauthorized vulnerability scans) after they have been confirmed as malicious. That is to say, if IPs are being blocked permanently, there should be some level of manual validation, since there are legitimate failures that can resemble attacks (e.g., login failures from a user's device after a password change) so you don't want to block legitimate business. There is a question I heard posed awhile back that can help reinforce the need for manual verification: What's the difference between a DDoS attack and just a successful website?

2

Yes, you should.

But you should also ask yourself for how long you will block any address which got onto your blacklist. Reasonable values might range from minutes to weeks, depending indeed on the subject of availability as mentioned on the comment by @Philipp.

Of course, by blocking an IP you run the risk of blocking an otherwise legitimate user. But at the same time, you need to make sure you keep your service and up for all other users as well.

If you are just ignoring IPs which your NIPS detects, you could switch if off as well.

  • But the NIPS does indeed block the attacks (base on the behavior rules). It just doesn't block the IP. Should I focus my time on investigating what the NIPS didn't detect? Or should I take the time to block an IP from which the attack was already prevented with the NIPS? – VBTech Oct 24 '18 at 17:13
  • An attacker will usually have a whole portfolio of attacks at hand; some of which you NIPS will prevent and other it may not. IMHO there is no reason to keep communicating with an attacker. In case the attacker is a hijacked machine of a legitimate person that intends to do proper business with you, you will possibly also help that person the most by blocking her so she will notice she has a problem. – TorstenS Oct 25 '18 at 11:11
0

There are multiple camps of thought on this, an above user mentioned how important is availability to you, some other things to consider, how good are your backups, how serious is the threat, do you have a WAF you can be utilizing, can you move your public facing infrastructure to the cloud and utilize proper DDOS, WAF and firewalls.

I always err on the side of caution and import the blacklists sent to us by the FBI and from the alien vault OTX that are relevant to my verticals or just plain nasty.

A lot of this is unfortunately dependent on your infrastructure, client needs and how secure you need/want to be.

With any web server I personally have ran in the past, I had it locked down with auto maintained blacklist rules, if someone was trying to attempt something malicious they were auto-shunned for a short period of time, then longer and longer until they were given a few chances and perma blacklisted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.